Skip to content

Commit 61c28dd

Browse files
roger-zhanggroger-zhangg
authored
feat(lambda): add grantInvokeLatestVersion to grant invoke only to latest function version (#29856)
### Issue # (if applicable) Closes #20177 ### Reason for this change `fn.grantInvoke()` will grant invoke permission to invoke both the latest version and all pervious version of the lambda function. We can see this behavior could bring some security concern for some of our customers. ### Description of changes We provides a new function `fn.grantInvokeLatestVersion()` to grant invoke only to the Latest version of function and the unqualified lambda arn Example: ```ts // Grant permissions to a service declare const fn: lambda.Function; const principal = new iam.ServicePrincipal('my-service'); fn.grantInvokeLatestVersion(principal); ``` ### Description of how you validated changes Added unit tests and integration tests. When using `fn.grantInvokeLatestVersion()` granted principle to invoke a function's past version, it will get the following error: ``` An error occurred (AccessDeniedException) when calling the Invoke operation: User: {$principle} is not authorized to perform: lambda:InvokeFunction on resource: {$LambdaArn:$version} because no identity-based policy allows the lambda:InvokeFunction action ``` ### Alternative design (to discuss) setup a `grantInvokeProp` including `grantVersionAccess` flag to pass in the `grantInvokeLatestVersion` instead using `grantVersionAccess` flag directly on `grantInvokeLatestVersion` -> This is discussed in the comments, I agree having props will have future extensibility but usually for grant methods specifically we haven't seen before. So we will not add prop to the new function `grantInvokeLatestVersion` ### Checklist - [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
1 parent e525de3 commit 61c28dd

11 files changed

Lines changed: 378 additions & 57 deletions

File tree

‎packages/@aws-cdk-testing/framework-integ/test/aws-lambda/test/integ.permissions.js.snapshot/cdk.out‎

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎packages/@aws-cdk-testing/framework-integ/test/aws-lambda/test/integ.permissions.js.snapshot/integ.json‎

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎packages/@aws-cdk-testing/framework-integ/test/aws-lambda/test/integ.permissions.js.snapshot/lambda-permissions.assets.json‎

Lines changed: 3 additions & 3 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎packages/@aws-cdk-testing/framework-integ/test/aws-lambda/test/integ.permissions.js.snapshot/lambda-permissions.template.json‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -117,6 +117,20 @@
117117
"Principal": "apigateway.amazonaws.com"
118118
}
119119
},
120+
"MyLambdaInvokeZQDUzUWqDuiGYFrGB6ik9uIPJSgF8GSLIg6NTO8jHPIBE1EB3A4": {
121+
"Type": "AWS::Lambda::Permission",
122+
"Properties": {
123+
"Action": "lambda:InvokeFunction",
124+
"FunctionName": {
125+
"Fn::GetAtt": [
126+
"MyLambdaCCE802FB",
127+
"Arn"
128+
]
129+
},
130+
"Principal": "*",
131+
"PrincipalOrgID": "o-xxxxxxxxxx2"
132+
}
133+
},
120134
"MyRoleF48FFE04": {
121135
"Type": "AWS::IAM::Role",
122136
"Properties": {
@@ -148,6 +162,52 @@
148162
"Arn"
149163
]
150164
}
165+
},
166+
{
167+
"Action": "lambda:InvokeFunction",
168+
"Effect": "Allow",
169+
"Resource": [
170+
{
171+
"Fn::GetAtt": [
172+
"MyLambdaCCE802FB",
173+
"Arn"
174+
]
175+
},
176+
{
177+
"Fn::Join": [
178+
"",
179+
[
180+
{
181+
"Fn::GetAtt": [
182+
"MyLambdaCCE802FB",
183+
"Arn"
184+
]
185+
},
186+
":",
187+
{
188+
"Fn::GetAtt": [
189+
"v192FF9954",
190+
"Version"
191+
]
192+
}
193+
]
194+
]
195+
},
196+
{
197+
"Fn::Join": [
198+
"",
199+
[
200+
{
201+
"Fn::GetAtt": [
202+
"MyLambdaCCE802FB",
203+
"Arn"
204+
]
205+
},
206+
":$LATEST"
207+
]
208+
]
209+
}
210+
]
151211
}
152212
],
153213
"Version": "2012-10-17"
@@ -159,6 +219,14 @@
159219
}
160220
]
161221
}
222+
},
223+
"v192FF9954": {
224+
"Type": "AWS::Lambda::Version",
225+
"Properties": {
226+
"FunctionName": {
227+
"Ref": "MyLambdaCCE802FB"
228+
}
229+
}
162230
}
163231
},
164232
"Parameters": {

‎packages/@aws-cdk-testing/framework-integ/test/aws-lambda/test/integ.permissions.js.snapshot/manifest.json‎

Lines changed: 14 additions & 11 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)